Cursor, GitHub Copilot, Codex, VS Code and Claude Desktop each built a browser into their AI assistant, then enriched it beyond what a normal browser allows. Those enrichments broke the browser threat model, letting a web page or a local file reach the machine behind it. Two issues remain unpatched.
Address Bar Spoofing, Prompt Injection, Arbitrary Code Execution & Local File Read, and more - a technical deep dive into how we hacked the embedded browsers that Cursor, GitHub Copilot, Codex, VS Code, and Claude Desktop ship natively in their AI assistants; two of the issues remain unpatched.
Forever caught live malware on a customer's machine attempting a new kind of attack: a file planted in the Downloads folder that turns your own AI coding agent against you. Here's how it works on Codex and Claude Code, and why the vector stays open.